Neo4j preserves Role-Based Access Control (RBAC) metadata when you perform a neo4j-admin backup for a database with the option --include-metadata=all , which is the default. This metadata includes users, roles, and privileges. Upon restoring the backup, a scripts folder should be available with the metadata Cypher script to restore the RBAC metadata associated with the restored database.

https://neo4j.com/docs/operations-manual/4.4/backup-restore/online-backup/#backup-command-options

This is also an important part of the migration process when migrating from Neo4j 4.4.x to Neo4j 5.x, as the system db itself cannot be migrated. As such this is the only semi-automatic way to preserve such RBAC metadata.

There is a caveat here, some privileges (and associated roles, and users with only such roles) will not be captured in the metadata. This is mentioned in the documentation for the --include-metadata option:

[NOTE] ==== Privileges specific to the DBMS and not to the backed-up database are not included in the backup. For instance, GRANT ROLE MANAGEMENT ON DBMS TO $role will not be backed up.

Accordingly, roles and users that do not have database-related privileges are not included in the backup (e.g. those with only DBMS or no privileges).

It is recommended to use SHOW USERS, SHOW ROLES, and SHOW ROLE $role PRIVILEGES AS COMMANDS to get the complete list of users, roles and privileges in these situations. ====

 

This additionally applies to home graph / database roles and privileges. For example, none of the users, roles, or privileges below will be captured in the backed up metadata, and will not come across after restoring a 4.x backup.

 

CREATE ROLE home_db_all;
GRANT ALL GRAPH PRIVILEGES ON HOME GRAPH TO home_db_all;
GRANT ALL DATABASE PRIVILEGES ON HOME DATABASE TO home_db_all;

 

As such we recommend using the same approach as documented for other metadata which is not captured on backups: usage of SHOW ROLE $role PRIVILEGES AS COMMANDS for any such roles, preserving such to run later.

While home database's metadata is now captured in backups made from Neo4j 5, the existing warnings in the --include-metadata documentation remain, as users or roles without database-specific privileges (such as those with only dbms privileges, or no privileges at all) will not be preserved.